Resolve the three dependency alerts with no upstream fix #198

Priority: P2

Context

No version bump fixes these three alerts, so they stay open in GitHub and Vanta until someone acts:

• http-cache-semantics, high (Dependabot alert #180)
• sprintf-js, medium (Dependabot alert #184)
• elliptic, low (Dependabot alert #162)

Do

For each package:

• Run yarn why <pkg> to find the parent.
• If a newer version of the parent drops it, bump or replace the parent.
• If not, write in the PR which dev-only tool pulls it in and why it's unreachable at runtime.

Done when

Each of the three is either gone from yarn.lock or has a written justification in the PR. Someone with Vanta access then uses that justification to dismiss the alert.

Source: code audit of stackbuilders/assertive-ts at e81a614 (2026-10-13) plus open Vanta/Dependabot findings.